Canonical's Snap Store Hit By Malicious Apps

[Myownfriend]

already am lol.
Will you continue squealing or will you accept the truth that end user should be carefull about installing software on their computer? especially anything related to finance

Being popular on here isn't a compliment.

You're the only one squealing about anything lol Nobody is saying that people shouldn't be careful about their finances. That hasn't been said once in this thread.

I'm saying that Canonical does bear some responsibility for hosting and distributing a malicious package. Obviously the person who made the package is most at fault but Canonical is easily the second most at fault.

This isn't just about financial apps. Obviously any application that asks to put in sensitive information can use it maliciously but that's not the only way that applications can act maliciously.

[Myownfriend]

1. Never cared about being popular.
2. Nah, you are squealing
3. I never said that canonical has no blame in this. Just said that ultimate responsibility is on end user.
4. so basically we agree on everything except the fact that you are squealing.

You're too old to be this 4chan-brained.

[Myownfriend]

i am never too old to mess with fools like you. Squeal more

You're such a cool, angsty, anti-hero.

[Myownfriend]

whatever. Squeal more

I think you meant "Squall more"

tumblr_lpn8ebnZkV1qb8m44o1_400.jpg

[guglovich]

We forced it on you, it's even glitchy sometimes, well now just forgive me. We can't give you both freedom and security.

[WorBlux]

Snap's (or flatpaks for that matter) 'sandboxing' is a partially baked idea. protects against accidental shenanigas but it's not the greatest against someone who wants to do harm

More specifically even the best sandbox isn't going to protect against the user entering information into the application, and it's not unusual for an application to phone home with data from time to time.

Really only banning non-source available and proprietary applications from the snap store would work, but the whole point of snaps is the provide a stable environment to distribute proprietary applications...

[espi]

Thankfully Snap doesn't allow third party repositories, so there is no way for the user to shoot themselves by adding a malicious third party repo! \s

Anyways, this actually highlights one of the problems of both Flatpak and Snap. Perfect sandboxing would protect the user even if they install a malicious app. But since apps can choose their own permissions all the sandboxing in the world wont do anything if the app just decides that it wants access to everything. The better alternative is an Android/iOS-like permission system, where the permissions are asked at runtime and presented front-and-center to the user ("why does this timer app want access to all my files???").

Of course one can revoke permissions after installing and before running an app (at least on Flatpak, I assume Snap also has a system for this). But most users will never realize and/or bother with doing that.

[Myownfriend]

P.s. i am hardcore leftist atheist and liberal. You moron.

LMAO I just noticed this. What a piss poor attempt at saying you aren't a conservative. In this one sentence you're giving away that you're not a leftist. I'll leave it to you to figure out how.

[Myownfriend]

Thankfully Snap doesn't allow third party repositories, so there is no way for the user to shoot themselves by adding a malicious third party repo! \s

Anyways, this actually highlights one of the problems of both Flatpak and Snap. Perfect sandboxing would protect the user even if they install a malicious app. But since apps can choose their own permissions all the sandboxing in the world wont do anything if the app just decides that it wants access to everything. The better alternative is an Android/iOS-like permission system, where the permissions are asked at runtime and presented front-and-center to the user ("why does this timer app want access to all my files???").

Of course one can revoke permissions after installing and before running an app (at least on Flatpak, I assume Snap also has a system for this). But most users will never realize and/or bother with doing that.

I agree that it's strange that Flatpak's don't prompt you for permissions. I don't even see anyplace on Flathub that tells you what permissions each app needs.

[Myownfriend]

lol you seriously think I'm gonna lose my mind over your hallucinations?

No. Never lol